A remote code execution vulnerability in iroha Board (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier. If a user accesses a specially crafted URL while being logged in to the affected product, arbitrary learning histories may be registered.
Cross-Site Request Forgery in Homerunner for WordPress allows unauthenticated attackers to update plugin settings if they can trick a site administrator into performing an action like clicking a link. The vulnerability stems from missing nonce validation in the main_settings() function, affecting all versions up to 1.0.29. Exploitation requires user interaction and no public exploit or active exploitation is currently known.
An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users with Guest role permissions to add child items to incident work items by sending crafted API requests that bypassed UI-enforced role restrictions.
Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior to 7.0.21 and MongoDB Server v8.0 version prior to 8.0.5.